The Hong Kong Association of Banks 


Frequently Asked Questions in relation to 
Anti-Money Laundering and Counter-Financing of Terrorism 


These Frequently Asked Questions (FAQs) in relation to Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) have been developed by the Hong 
Kong Association of Banks (HKAB) with input from the Hong Kong Monetary Authority (HKMA). This document does not form part of the Guideline on Anti-Money 
Laundering and Counter-Financing of Terrorism (For Authorized Institutions) (AML/CFT Guideline) and it is designed to be read in conjunction with the AML/CFT 
Guideline. Terms and acronyms used in this document have the same meanings as in the glossary to the AML/CFT Guideline. 


These FAQs aim to assist Authorized Institutions (Als) regulated by the HKMA in understanding relevant AML/CFT requirements. Als are expected to be fully 
conversant with these FAQs, and to have regard to them in meeting their AML/CFT legal and regulatory obligations. These FAQs are, however, by their nature 
framed as general statements and do not take into account the particular circumstances of an Al. Als should therefore consider the money laundering and terrorist 
financing risks to which they are exposed and their own circumstances (among others) before taking action on matters to which these FAQs may be relevant. These 
FAQs should not be regarded as a substitute for obtaining legal or other professional advice on AML/CFT requirements. 

This document will be kept under review and updated from time to time as necessary. 


Note: This new set of FAQs will supersede the version issued on 24 May 2021. 
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Paragraph 


Trigger events for an 


An Al should conduct its institutional ML/TF risk assessment every two years and when material trigger events 











2.9 of the updated IRA occur. Non-exhaustive examples of such trigger events may include when: 
ae What is regarded as a (a) there is a significant breach of the Al’s AML/CFT Systems detected; or 

Moger San ar ine (b) one of the following has occurred and the Al has assessed that it will materially impact upon its 

purpose of determining when t of the institutional ML/TF risks to which iti d: 

An Alishould undertakes assessment of the institutiona risks to which it is exposed: 

review of its institutional 1. the Al acquires a new customer segment or delivery channel; 

ML/TF risk assessment? 7 

2. the Al launches new products or services; or 
3. there is a significant change of operational processes (eg use of new technology). 

Paragraph Simplified and enhanced These two paragraphs refer to enhancing or simplifying the AML/CFT policies, procedures and controls (ie 
3.2 and 3.3 AML/CFT Systems AML/CFT Systems), as distinct from EDD or SDD measures articulated in Chapter 4. They set out the basis 
the AML/CFT p hs 3.2 and 3.3 of for an Al to adopt a risk-based approach in its overall AML/CFT Systems across the institution. The application 
Guideline aT aie li ` a t of these two paragraphs should be based on the Al’s institutional ML/TF risk assessment. Depending on how 

rane AML/CET rae re Ine state | the Al assesses its ML/TF risks, a risk-based approach can be applied on a specific customer segment, a 

NTA Yren can specific line of business, or a specific product or service offered. 
be simplified or enhanced, 
what does this mean? For example, subject to other criteria set out in paragraphs 3.2 and 3.3, a line of business assessed to have 
lower ML/TF risks may be subject to less frequent internal audit reviews, less frequent/onerous reporting 
requirements to senior management, or have simpler AML/CFT procedures etc. 

Paragraph Independent validation Such validation can be performed by an external party or the internal audit function of the Al (see paragraph 
5.8 of the ; 3.11 of the AML/CFT Guideline). 

Who can independently 
AML/CFT : , : 
Guideline validate an Al’s transaction 





monitoring systems and 
processes? 
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4 Paragraph Hong Kong residents The following are examples of documents that would be considered to be reliable and independent for Hong 

4.3.3 of the Kong residents (both permanent and non-permanent residents). 

AML/CFT What documents would be : 

Giideline regarded as “reliable and Hong Kong residents aged 12 or above: Hong Kong identity card 
independent’ for verifying the 
identity information of a Children under 12 born in Hong Kong: the child’s Hong Kong identity card, birth certificate or valid travel 
natural person customer who | document. In such circumstance an Al should generally regard the minor's parent or guardian as a person 
is a Hong Kong resident? acting on behalf of the child and conduct the relevant CDD measures. 

Paragraph Non-Hong Kong residents | The following are examples of documents that would be considered to be reliable and independent for non- 

4.3.3 of the Hong Kong residents: 

AML/CFT What documents would be 

Guideline regarded as “reliable and (a) avalid travel document; 


independent’ for verifying the 
identity information of a 

natural person customer who 
is not a Hong Kong resident? 


(b) a national (ie Government or State-issued) identity card bearing the photograph of the natural person; or 


(c) avalid national (ie Government or State-issued) driving licence incorporating photographic evidence of 
the identity of the natural person. 





6 Paragraph 
4.3.3 of the 
AML/CFT 
Guideline 








Travel documents 


What are acceptable “travel 
documents’ for the purpose 
of paragraph 4.3.3? 





The following documents are examples of travel documents for the purpose of identity verification: 
(a) Passport 
(b) Mainland Travel Permit for Taiwan Residents 


(c) Seaman’s Identity Document (issued under and in accordance with the International Labour Organisation 
Convention/Seafarers Identity Document Convention 1958) 


d) Taiwan Travel Permit for Mainland Residents 
e) Permit for residents of Macau issued by Director of Immigration 
f) Exit-entry Permit for Travelling to and from Hong Kong and Macau for Official Purposes 


g) Exit-entry Permit for Travelling to and from Hong Kong and Macau 
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Paragraph 
4.3.3 of the 
AML/CFT 
Guideline 


Travel documents 


What part of the “travel 
documents” should be kept 
on file? 


An Al should retain a copy of the “biodata” page of the travel documents, containing the bearers photograph 
and biographical details, for the purpose of the record-keeping requirements in the AMLO and the AML/CFT 
Guideline. 





: Paragraph 


British National (Overseas) 


Reference should be made to the announcement made by the HKSAR Government dated 29 January 2021 





4.3.3 and passport (BN(O)) (https://www.info.gov.hk/gia/general/202101/29/P2021012900763.htm) that BN(O) passport would not be 
4.5.3 of the Can an Al use (BN(O)) recognised as a valid travel document and any form of proof of identity in Hong Kong with effect from 31 
AML/CFT : : January 2021. 
Cuicdeane passport for identity 

verification? 

9 Paragraph Documents that do not This is acceptable only in exceptional circumstances where the customer’s associated ML/TF risk has been 
4.3.4 of the have photographs addressed and mitigated. Exceptional circumstances include where the customer is an asylum seeker who 
AML/CFT c Avei he ani does not have proper identification documents with photographs but has a recognizance form issued by the 
Guideline AANS MEYE GENY Hong Kong Immigration Department. 








of a natural person customer 
on the basis of a document 
that does not contain a 
photograph? 





If exceptional circumstances apply, an Al may validate a customer’s identity with reference to a government- 
issued document (without a photograph). In such circumstances, additional measures (eg setting appropriate 
limits to the account; limiting the product and services provided; or conducting enhanced monitoring etc) should 
be taken to mitigate increased risk. 
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Relevant Question 


provisions 












Paragraph Change of name ofa If a natural person customer changes their name, an Al should verify the new name by reference to documents, 
4.3.2 of the natural person customer data or information provided by a reliable and independent source following paragraph 4.3.3 of the AML/CFT 
AML/CFT if fara Guideline. To mitigate the risk of impersonation, the Al should corroborate other identification information (eg 
Guideline ana ura person date of birth, Hong Kong Identity Card number) on the new identification documents against its existing 
ELON Fein Lie records. In case of doubt, the Al may request a copy of applicable documentation regarding the name change 


a a (eg marriage certificate or deed poll). 


For the avoidance of doubt, if a customer's name has changed before the establishment of a business 
relationship, only the current name is required to be identified and verified. 


Identification and verification of identity — natural persons (using IAM Smart)' 








Paragraph iAM Smart for identity 


ee a = a vetiticerien The AMLO permits the use of “documents” as well as “data or information” provided by a reliable and 


AML/CET Can an Al verify the identity independent source, including, where applicable, electronic identification means. There are no restrictions on 
of a natural person using iAM | the form (documentary / physical or digital) that identity evidence — “documents, information or data” — can 
Smart (previously known as take. 

"elD")? 


Yes, iAM Smart can satisfy customer identification and verification requirements under the AMLO. 


Guideline 


iAM Smart is the digital identity developed by the Hong Kong Government. Hong Kong residents can register 
for iAM Smart using the iAM Smart mobile application. The registration process is in line with the two identity 
verification principles: identity authentication and identity matching. 

















1 The FAQs under this section are to assist Als in understanding how iAM Smart can be used in complying with the relevant AML/CFT requirements. Als should have regard to the latest features 


and key components of iAM Smart, which can change over time, as well as their own AML/CFT policies and procedures, before using iAM Smart. 
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Paragraph iAM Smart for remote on- As stated in the preceding FAQ, iAM Smart can be used as an alternative to the physical identification 

4.1.3 and boarding document used for the purpose of meeting the customer identification and verification requirements in the 

4.3.1 of the weni omi edine context of remote on-boarding. However, iAM Smart by itself cannot generally help Als in meeting the broader 

AML/CFT : CDD requirements that go beyond customer identification and verification. 

Cncaune the remote on-boarding of a 
individual customers? When designing their remote on-boarding model, Als should have regard to the latest features of iAM Smart to 

determine how their own CDD or customer on-boarding policies and procedures can be met. This may 
necessitate the collection of additional documents or other information where it is considered necessary for the 
purpose of CDD, ongoing monitoring or other compliance and risk management. 

Paragraph Additional identity To satisfy customer identification and verification requirements under the AMLO, where iAM Smart is used, 

4.3.4 of the document that contains a there is no additional requirement to obtain other identification documents or separately obtain a photograph of 

AML/CFT photograph the natural person customer. 

Guideline When iAM Smart is used for | For the avoidance of doubt, paragraph 4.3.4 requires the identity document obtained by an Al to contain a 
identity verification, do Als photograph of the customer to mitigate impersonation risks. In the context of iAM Smart, impersonation risks 
need to obtain additional are mitigated by the access controls of the iAM Smart mobile application (e.g. biometric authentication to log in 
identification documents that | iAM Smart). 
contain a photograph to 
verify the identity of a natural 
person? 

4 Paragraph Retention of records Paragraph 8.3 requires Als to keep the original or a copy of the documents, and a record of the data and 

8.3 of the menin eae eaa information, obtained in the course of identifying and verifying the identity of the customer. When iAM Smart is 

AML/CFT ; s ANE ; used for identifying and verifying the identity of the customer, relevant data and information should be kept. 

Guideline peed babii ee This may include all the specific data or information obtained from iAM Smart through API, showing the 
OL TECorESIe ae ue customer’s iAM Smart authentication result and verified Hong Kong Identity Card data. The objective is to 
should Als retain’ permit reconstruction of the customer's identity. For the avoidance of doubt, Als do not need to obtain 

additional identification documents solely for record keeping purposes. 
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Paragraph 
4.3.6 of the 
AML/CFT 
Guideline 


Non-Hong Kong company 
registered in Hong Kong 


What minimum identification 
information should be 
obtained for a non-Hong 
Kong company registered in 
Hong Kong under the 
Companies Ordinance? 


For a non-Hong Kong company registered in Hong Kong under section 776 of the Companies Ordinance?, 
taking into account the registration made in Hong Kong, an Al should obtain at least the following identification 
information for the purpose of fulfilling paragraph 4.3.6 of the AML/CFT Guideline: 


(a) Full name 


(b) Date of incorporation, establishment or registration 

(c) Place of incorporation, establishment or registration 

(d) Address of the registered office (or its equivalent) in the place of incorporation 

(e) | Unique identification number and document type in the place of incorporation or company registration 
( 


f) | Address of principal place of business in Hong Kong 





6 Paragraph 


Principal place of business 


The “principal place of business” means the location where a legal person primarily operates or the place of its 











customer to provide “address 
of registered office” 
information? 





4.3.6 of the : Pierce. main activities. It can be the same as, or differ from, the address of registered office. 

AML/CET What is the “principal place 

Cucina of business’ of a legal Legal persons, depending on their business nature, may operate in various locations of different natures. If the 

person? address of the principal place of business of a legal person is not in in line with the Al’s understanding of the 

legal person’s business nature or customer profile, an Al should seek to understand the rationale for why that 
address is provided to the Al. 

Paragraph Address of registered Paragraph 4.3.6 requires Als to obtain the address of registered office of a legal person. As this address is 

4.3.6 of the office usually included in the document provided by a reliable and independent source (eg certificate of incumbency) 

AML/CFT Are Al edit kth being obtained for verification of the legal person's identity, an Al may, instead of asking the customer to 

Guideline [S GS AU Oe me provide the information on address of registered office, just copy the address from the document obtained. 








2 


of business in Hong Kong 
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Under section 776 of the Companies Ordinance, a non-Hong Kong company is required to register as a registered non-Hong Kong company within one month after the establishment of the place 











: Paragraph 
4.3.7 of the 
AML/CFT 
Guideline 


Business registration 


When should a record of 
business registration be 
obtained for the purpose of 
verifying the identity of a 
legal person? 


A record of business registration, which is a type of “record of registration” as stated in paragraph 4.3.7 of the 
AML/CFT Guideline, is usually regarded as the primary document to verify the identity of a legal person 
customer that is not required to register with the Hong Kong Companies Registry or similar authority, such as a 
sole proprietorship, partnership or a unincorporated body etc. 


It is worth noting that Als are not required to obtain a record of business registration for every customer that is a 
legal person. For instance, for a Hong Kong incorporated company, an Al can generally rely on the company 
record filed at the Hong Kong Companies Registry to verify the identity of the customer without the need to 
obtain its record of business registration. 





9 Paragraph 
4.3.7 and 
4.3.8 of the 
AML/CFT 
Guideline 


Partnership details 


What documents need to be 
obtained to verify the identity 
of a partnership? 


The identity of a partnership can be verified by a record of registration or a partnership agreement or deed 

(which may be an extract or redacted version for customers / circumstances that are not deemed to present a 
high ML/TF risk). However, if a record of registration is obtained, an additional document may be required to 
understand the powers that regulate and bind the partnership, which may not be covered by that record itself. 


If the customer (ie the partnership) is a well-known, reputable organisation with a long history in its industry and 
there is substantial public information about the customer, its partners and controllers, then confirmation of the 
customer’s membership of a professional or trade industry is likely to be sufficient to verify the identity of the 
customer. 





0 Paragraph 
4.3.6 to 4.3.9 
of the 
AML/CFT 
Guideline 








Start-ups and SMEs 


Are there any specific CDD 
requirements for start-ups 
and small and medium-sized 
enterprises? 





Similar to AML/CFT requirements in other jurisdictions, the requirements in the AML/CFT Guideline are 
principle-based in order to provide flexibility to Als to apply them to different types of customer. 


There are no specific requirements for, or mention of, start-ups or small and medium-sized enterprises. 
However, Als should not adopt a one-size-fit-all approach in the application of CDD requirements. Als should 
ensure that the design and implementation of their CDD requirements reflect both the operation and profile of 
these legal persons, the risk level as assessed by the Al concerned and any other relevant considerations. 
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Paragraph Overseas customers Obtaining information to understand the purpose and intended nature of the business relationship being 
4.6.1 of the Net dditional CDD established, including the reason for establishing the relationship, is a standard CDD measure applicable to all 
AML/CFT EE types of customers and cascades from international standards with which Hong Kong is required to apply. In 
Guideline requiremenie (eg > some cases the purpose and intended nature will be obvious or self-evident and therefore may not need to be 
understanding the rationale provided by the customer, having regard to the types of accounts to be established or services/products to be 
to establish a business used 
relationship in Hong Kong) ; 
for a company which is Applications for account opening should not be rejected merely because the customer is incorporated or 
incorporated overseas or has | established offshore, or because the beneficial owners or directors of a corporate customer are non-residents. 
foreign directors/beneficial Als’ on-boarding procedures should recognise that offshore establishment and non-resident directors, etc are 
owners? common profiles for many corporates seeking banking services in an international financial centre, like Hong 
Kong. Similarly, in addition to collecting the information, Als should view residence of beneficial owners or 
directors as only one part of the CDD and risk profiling exercise, and understand the rationale why a particular 
type of business relationship is sought, taking into account the customer’s business model or mode of 
operation. 
Paragraphs Identification information Als should generally obtain the name, date of birth, nationality and unique identification number (and document 
4.4.3 of the i type) of a beneficial owner. 
AML/CFT eoep e Eara ace | S 
Guele should endeavour to obtain However, there may be situations where not all the identification information of a beneficial owner can be 
the name, date of birth, obtained by the Al (eg only year of birth, not the date of birth, can be obtained). 
et e Given the legal and regulatory requirement is for the Al to be satisfied that it knows who the beneficial owner is, 
document type) of a if the Al cannot obtain all the identification information of a beneficial owner, it should assess whether the 
Geneticlalowner information obtained is sufficient to identify the beneficial owner, and where necessary, consider whether 
Å additional steps are required to ensure it is satisfied that it knows who the beneficial owner is. 
What is meant by “as far as 
possible”? 
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Paragraph Reasonable measures The term “reasonable measures” means appropriate measures which are commensurate with the ML/TF risks. 
4.4.1, 4.4.2 AP AlcnOUldital Als should adopt a risk-based approach in relation to verifying the identity of beneficial owners. How far an Al 
and 4.4.9 of PS TE sen E 6 should go and what will be considered reasonable will depend on the assessed risks associated with the 
the AML/CFT e e Enio al business relationship, customer and/or transaction. This could include corroborating information from publically 
Guideline es eee a available sources such as through search engines or within commercial databases. 
What is meant by 
“reasonable measures” ? 
sE Paragraph Definition of beneficial The following are some examples of natural persons who could be considered as beneficial owners on the 
4.4.5 of the owner basis that they exercise ultimate control? over the management of the corporation: 
akaa Who should be considered (a) A natural person who exerts control of a legal person through means such as personal connections to 
Guideline Bieta ne 7 Nees 
as an individual who persons who would be beneficial owners due to owning more than 25% of the shares or voting rights. 
e o (b) A natural person who exerts control without ownership by participating in the financing of the enterprise, or 
corporation”? because of close and intimate family relationships, historical or contractual associations, or if a company 
i defaults on certain payments. Furthermore, control may be presumed even if control is never actually 
exercised, such as using, enjoying or benefiting from the assets owned by the legal person. 
There is no requirement to actively identify a person exercising ultimate control over a customer where nothing 
obtained during the CDD process suggests that such a person exists. 
Paragraph Senior managing official Examples of positions of senior managing official include chief executive officer, chief financial officer, 
4.4.8 of the Whois tobe redarded managing or executive director, president, or natural person(s) who has significant authority over a legal 
AML/CFT A ae iat ieee person’s financial relationships, the ability to establish material business relationships (including with Fls that 
Guideline pee re CneEr forthe hold accounts on behalf of a legal person) and the ongoing financial affairs of the legal person. 
purpose of paragraph 4.4.8? | When there is no natural person who is a “beneficial owner” as defined in the AMLO, Als should identify the 
relevant natural persons who hold the position of senior managing official, and take reasonable measures to 
verify their identities. Als can rely on the information provided by the customer to identify who holds these 
positions. 
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As described in the third limb of the definition of an individual who is defined as a beneficial owner in relation to a corporation in paragraph 4.4.5(a) of the AML/CFT Guideline. 


10 














Paragraph Register of beneficial This will depend on the jurisdiction involved, the Al’s assessment of ML/TF risk related to the jurisdiction 
4.4.9 and owners (including with reference to FATF evaluations) and the definition of beneficial owner under the laws of the 
footnote 25 of Gay UAT TAY on areosa jurisdiction. Note that if the definition of beneficial owners in that jurisdiction differs from the AMLO and the 
the AML/CFT iv i fici ee oma Ba Sie AML/CFT Guideline (eg different threshold is adopted), the Hong Kong standard applies in relation to all 
Guideline Or SENSCIA Owners ror business relationships established or maintained by the Al concerned. 

identification purposes? 
Paragraph Presence of directors or The presence of two or more, or all, directors or beneficial owners at the time of account opening is not 
4.5 and beneficial owners at required by the HKMA. 
Ao onne account opening Generally, a corporate account is opened in the name of a legal person by a natural person who is authorised 
AML/CFT 3 : eae : ; ; 
Cuidcune Is there a requirement that to act on behalf of that legal person to establish business relationship with an Al. The basic requirement is for 


directors and beneficial 
owners of a legal person be 
present at account opening? 


an Al to identify and verify the identity of that natural person as well as obtaining the written authority to verify 
that the natural person has the authorisation of the legal person to establish a business relationship with the Al 
concerned. 


For the avoidance of doubt, if such natural person is not physically present for identification purposes, the Al 
should mitigate any increased risk in accordance with paragraph 4.10.4 of the AML/CFT Guideline. 








Footnote 41 
of the 
AML/CFT 
Guideline 





New legal entity customer 
where the beneficial owner 
is already known 


Where a new-to bank-legal 
person customer is to be 
onboarded, and the 
beneficial owner is already 
known to the bank (and has 
been subject to identification 
and verification processes 
previously) does the 
beneficial owner have to 
provide updated ID for the 
purposes of on-boarding the 
new legal person customer? 





If the identity of a beneficial owner of a new-to-bank legal person customer has previously been verified by an 
Al (eg the beneficial owner is the Al’s existing customer; or the beneficial owner is a beneficial owner of the Al’s 
existing customer), Als do not generally need to re-verify their identities unless doubts arise as to the veracity 
or adequacy of the information previously obtained - for example, if it is no longer current. 
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Paragraph Ownership charts An Al is obliged to understand the ownership and control structure of its customers. Although obtaining an 

4.4.14 of the Is it eign io obla d ownership chart from the customer is the most convenient way of doing this, there is no strict requirement to do 

AML/CFT s it mandatory to obtain an So. 

Cuidcune verify an ownership chart for C3 i i i , i 

a legal entity customer? In deciding whether an ownership chart should be obtained, an Al should take into account the risk profile of 

the customer and the complexity of the ownership or control structure. 
Although an Al needs to identify any intermediate layers, it needs not, as a matter of routine, verify the details 
of the intermediate companies in the ownership structure. Whether this is necessary will depend upon the Al’s 
overall understanding of the structure, the customer’s risk profile and whether the information available is 
adequate in the circumstances for the Al to consider if it has taken adequate measures to identify the beneficial 
owners. 

Paragraph Ownership charts No, it is not a requirement. Since an ownership chart is a document prepared by the customer, a declaration 

4.4.14 of the et arearen io obana by the customer's director may not make the chart more reliable. However, as a director declaration evidences 

AML/CFT Fie a Brae Coen tie that a person with authority over the customer and who should have a close knowledge of its structure has 

Guideline ownership chart obtained? signed it off, it may be considered to mitigate the risk of inaccurate or out-of-date information being presented. 
If an Al has doubt about the integrity of an ownership chart provided by the customer, it should take other steps 
to understand the ownership and control structure (eg obtain additional information or verify the details of the 
intermediate companies in the ownership structure). 

Paragraph Intermediate layers An Al should determine on a risk-sensitive basis the amount of information to be collected to identify each legal 

4.4.14 of the Do Ale Head to obtain all person or legal arrangement in the intermediate layer of a customer’s ownership and control structure, which at 

AML/CFT identification inf ti a minimum should include their names. Further information, such as the place of incorporation and/or rationale 

Guideline CENTE ATOM ee een behind the particular structure adopted, may be required on a risk-based approach. 





listed in paragraphs 4.3.6 
and/or 4.3.11 of the 
AML/CFT Guideline in 
relation to each legal person 
or legal arrangement in the 
intermediate layer of a 
customer’s ownership and 
control structure? 
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Paragraph Identifying and verifying Where the customer involves a trust or other similar arrangement, Als should: 
ee ae eee a eee (a) take the CDD measures in respect of the trust as required by the AMLO and AML/CFT Guideline; and 
AML/CFT trust (b) where the trustee is: 
cee Where the customer involves (i) regarded as the Al’s customer (which would normally be the case), identify and verify the identity of 
a trust or other similar the trustee having regard to the usual standards for customers that are individuals or legal 
arrangement, how should an persons, as applicable; or 
fee x dale di hg (ii) not regarded as the Al’s customer (eg where the trust has its own legal personality; or where the 
trust appears as part of an intermediate layer), identify and take reasonable measures to verify the 
identity of the trustee. Reasonable measures may include corroborating the undertaking or 
declaration obtained with publicly available information. 
Paragraph A trust appears as part of If a trust or other similar legal arrangement appears as part of an intermediate layer, the Al should identify and 
4.4.12 of the an intermediate layer take reasonable measures to verify the identity of the trustee. For example, where a trustee is acting in its 
AML/CFT m daca N ani professional capacity (ie acting as a trustee in the course of profession or business) (eg a TCSP licensee) it 
Guideline : emy may be appropriate to verify the identity of the trustee by checking the relevant regulatory register (eg the 
and verify a trustee if the Register of TCSP Licensees made available by the Companies Registry). 
trust appears as part of an 
intermediate layer? 
Paragraphs Beneficial owners of a A beneficial owner is normally a natural person who ultimately owns or controls the customer or on whose 
4.4.1, 4.4.11 trust customer behalf a transaction or activity is being conducted. Where a settlor, protector or enforcer of a trust customer is 
and 4.4.12 of Wh ttl Ec a legal person, the objective remains to follow the chain of ownership or control to the beneficial owner (ie a 
the AML/CFT rera SSU Or ProtECIOROr | fiatiral person) in accordance with paragraph 4.4.14 of the AML/CFT Guideline, and to identify and take 
Guideline enforcer of a trust customer reasonable measures to verify the identity of such natural person. 





is a legal person, who should 
an Al identify and take 
reasonable measures to 
verify the identity of, as a 
beneficial owner? 
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Paragraph 
4.4.13 and 
footnote 26 of 
the AML/CFT 
Guideline 


Trust beneficiary 


For a beneficiary of a trust 
designated by characteristics 
or by class, what other 
examples of information 
concerning the beneficiary 
can be obtained by the Al in 
addition to the one provided 
in footnote 26 of the 
AML/CFT Guideline? 


Examples of information concerning the beneficiary designated by characteristics or class may include: 
(a) the nieces, nephews, cousins or grandchildren of certain persons as at the time of their death; 

(b) certain award recipients approved by a prescribed charity as at a certain date; 

(c) one or more charities relating to a particular cause that are selected by a prescribed person. 


The aim is to satisfy the Al that it will be able to establish the identity of that beneficiary at the time of payout or 
when the beneficiary intends to exercise vested rights. 








6 Paragraph 
4.5.1 of the 
AML/CFT 
Guideline 








Identifying the PPTA 


Who should be treated as a 
PPTA? 





A person may utilise a business relationship established between an Al and another person (natural or legal 
person) or legal arrangement to conduct ML/TF activities. FATF Recommendation 10 requires financial 
institutions to identify and verify the identity of any person purporting to act on behalf of the customer (PPTA), 
and the AMLO adopts the same requirement. 


Neither the FATF Recommendations nor the AMLO define the scope of PPTA. The AML/CFT Guideline 
explains that whether the person is considered to be a PPTA should be determined based on the nature of that 
person’s roles and the activities which the person is authorised to conduct, as well as the ML/TF risks 
associated with these roles and activities. 


At a minimum, a person who is authorised to act on behalf of a customer to establish a business relationship 
with an Al should always be treated as a PPTA. 


Als should adopt a framework of procedures for assisting their employees in assessing who would ordinarily be 
considered a PPTA for each customer segment. The approach and rationale should be consistent across 
departments and customer segments, to the extent possible. 


As a general proposition, each legal person customer should have at least one PPTA (ie the person acting on 
behalf of a customer to establish the business relationship with the Al as mentioned above) but there may be 
multiple PPTAs. PPTAs may also act alone or jointly. However, it is recognised that there may be some 
scenarios where no PPTA will be identified where this is unavoidable by virtue of the nature of the 
arrangements. Examples may include: correspondent banking relationships where account opening/payment 
instructions are provided via authenticated payment platform like SWIFT; or where the customer is onboarded 
solely due to the involvement of local staff, but no account is opened and no contract is signed with an Al in 
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Hong Kong, and relevant instructions come from another branch in the Al’s group. 





Paragraph 
4.5.1 of the 
AML/CFT 
Guideline 








Account signatory 


Should all account 
signatories of a customer be 
considered as PPTAs? 





Account signatory refers to an individual authorised by a customer to transact on behalf of the customer or 
operate the customer's account / business relationship. While Als have to guard against unauthorised 
transactions, this risk mainly relates to fraud and is different from ML/TF risk. Als normally obtain names, 
specimen signatures and written authorisation of all account signatories to guard against this risk. 


Therefore, not every account signatory is required to be identified and verified for AML/CFT purposes (ie not 
every account signatory should be considered as a PPTA). The AML/CFT Guideline explains that whether the 
person is considered to be a PPTA should be determined based on the nature of that person’s roles and the 
activities which the person is authorised to conduct, as well as the ML/TF risks associated with these roles and 
activities. For example: 


e Example 1: Person A appoints Person B as the account signatory of their bank account and provides 
Person B with unlimited authority to direct how funds move in and out of the account. Person Bis a 
PPTA. 


° Example 2: Company Y appoints a number of staff as the account signatories (including Person E). 
Person E is not authorised to move funds in Company Y’s account but is authorised to issue a cheque 
up to a reasonable amount if it is co-signed by another staff member. In this case, Person E is unlikely 
to be a PPTA given the ML/TF risk associated with Person E’s role is limited. 
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*— | Paragraph Lists of signatories 


hie ares! Is an Al required to identify 
Guideline and verify the identity of all 


account signatories? 


Account signatories are only required to be identified and verified if they are a PPTA. Instead of verifying the 
PPTAs’ identities by reference to the identification document, data or information for each PPTA, Als may take 
other reasonable measures (ie appropriate measures which are commensurate with the ML/TF risks). For 
example, where a business relationship is assessed to present a low ML/TF risk, an Al could verify the PPTAs 
identities by reference to a list of PPTAs, whose identities and authority to act have been confirmed by a 
department or person within that customer which is independent to the persons whose identities are being 
verified (for example, compliance, audit or human resources). 


For the avoidance of doubt, as indicated in paragraph 4.5.3 of the AML/CFT Guideline, the Al is required to 
identify the PPTA by obtaining at least the following identification information: 





Natural person PPTA Legal person PPTA 





(a) full name; (a) full name; 
(b) date of birth; (b) date of incorporation, establishment or 
(c) nationality; and Fegisttalion, 
A ; eee (c) place of incorporation, establishment or 
(d) a kienitiiceiion numer ano cocumeni registration (including address of registered 


office); 


(d) unique identification number and document type; 
and 


(e) principal place of business (if different from the 
address of registered office). 

















g Paragraph Persons purporting to act 


4.5.1 of the on behalf of the customer 
AML/CFT 
Guideline Should dealers and traders 


in an investment bank or 
asset manager be 
considered as PPTAs? 











Dealers and traders in an investment bank or asset manager who are authorised to act on behalf of the 
investment bank or asset manager would not ordinarily be considered as PPTAs. However, there is no “one 
size fits all” approach given the differences in roles and ML/TF risks involved. An Al should have a 
documented policy that applies a reasonable approach, having regard to the ordinary meaning and other FAQs 
relating to PPTAs. 
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Paragraph Connected parties The purpose of obtaining the names of all the connected parties of a customer is to facilitate the sanction 
4.3.18 and screening requirements set out in paragraph 6.17 of the AML/CFT Guideline. 
4.3.19 of the Why does an Al need to 
AML/CET obtain the names of all the 
Cuigeune connected parties of the 

customers that are legal 

persons or legal 

arrangements? 
Paragraph Connected parties Paragraph 4.3.19(d) only applies to customers that are not corporations, partnerships, or trust or other similar 
4.3.19 of the Mno ato be oacrdcd ae arrangements, so these customers may include, for example associations, clubs, societies, charities etc. 
AML/CFT “holdi g Whether a natural person is regarded as holding a senior management position or having executive authority of 
Guideline POIDA SEION EE these customers depends significantly on the management structure of the customers concerned. It is 

MEME CMOO POON OF generally for the Al to determine based on its understanding of the customer’s management structure obtained 

having executive authority in through the CDD 

gh the process. 
a customer’ for the purpose 
of paragraph 4.3.19(d)? Examples of person holding a senior management position or having executive authority may include the 
president, vice-president, secretary or treasurer of the customer. 

Paragraph “Current” data etc Whether a document provided by a customer should be regarded as “current” depends on the nature of the 
Aes N O document. The e, K may give Als some E | au 
Guideline documents, data or (a) for a document with an expiry date (eg passport), it cannot be expired at the time of verification; 





information obtained is 
current at the time they are 
provided to the Al. What is 
meant by the term “currenť’? 





(b) for a document that will be updated on a frequent and specified basis (eg an annual return), the Al may 
generally accept the latest version of the document; 


(c) fora document that does not have an expiry date and is not required to be regularly updated (eg 
certificate of incumbency or certificate of good standing issued by the registered agent of an overseas- 
incorporated company), unless there is an independent and reliable public source of information to verify 
its reliability, the Al should only accept the document if it was issued within a reasonable timeframe (ie a 
reasonable timeframe from the date it is received or obtained by the Al. 6 months is generally regarded 
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as reasonable but this can be adjusted taking an RBA). 


Als may also obtain a written assurance that the document obtained is current from the customer, its PPTA or 
a reliable third party. Als should also be aware of any inconsistencies between the document obtained and 
those that have been determined by the Al to be current. 


The above guidance equally applies if data or information (eg digital identity recognised by government) is 
used for identity verification. 





á Footnote 41 
of the 
AML/CFT 
Guideline 


Expired documents 


If a previously obtained 
identity document such as 
passport of a customer is 
expired, does the Al need to 
re-verify any aspect of 
customer identification by 
obtaining a current identity 
document? 


Als do not need to re-verify any aspect of customer identification just because of the expiry of a previously 
obtained identity document. According to footnote 41 of the AML/CFT Guideline, once the identity of a 
customer has been satisfactorily verified, there is no obligation to re-verify identity unless in specified 
circumstances; however, Als should take steps from time to time (ie during a periodic or trigger event CDD 
review) to ensure that the customer information that has been obtained is up-to-date and relevant. 





AL Paragraph 
4.3.16 of the 
AML/CFT 
Guideline 








Electronic documents 


What measures are Als 
expected to take to ensure 
the reliability of identification 
documents which are in 
electronic form? 





The AML/CFT Guideline recognises that some commonly used original identification documents can be in 
electronic form. The Al should take appropriate measures to ensure the reliability of the electronic documents. 
The appropriateness of the measures to be taken will depend on the type of identification document in 
question. The following examples may apply: 





Electronic document Appropriate measure to ensure reliability 





When accepting a print copy of an electronic Certificate of 
Incorporation, an Al can corroborate with other identification 
document or information (eg record of company registries) to ensure 
the reliability of the print copy. 


Original certificate of incorporation 
issued by the Hong Kong 
Companies Registry in electronic 
form 














Note: For the avoidance of doubt, corroboration would not be required for instances where the Al itself has 
downloaded a particular document (as opposed to having received a print copy of it) from a reliable source (eg 
Hong Kong Companies Registry’s website). 
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Paragraph Document in foreign There is no requirement that the translation has to be performed by a professional third party (eg solicitor) or 
4.3.17 of the language someone who is qualified; Als may obtain a translation from a reliable source, which may include technology 
AML/CFT : solutions and commonly used translation tools. 
Guideline Does the translation need to 
be performed by a 
professional third party (eg 
solicitor)? 
Paragraph Certification The following is a list of non-exhaustive examples of appropriate persons to certify verification of identification 
4.10.3 of the documents: 
AML/CET Who would be regarded as 
Gudeine an appropriate certifier for (a) anintermediary specified in section 18(3) of Schedule 2; 
the purpose of paragraph fai ne arate AAI AR TUTSCICHOR: 
4.10.3 of the AML/CET (b) amember of the judiciary in an equivalent jurisdiction; 
Guideline? (c) an officer of an embassy, consulate or high commission of the country of issue of documentary 
verification of identity; 
(d) a Justice of the Peace; and 
(e) other professional person such as certified public accountant, lawyer, notary public or chartered 
secretary Noe, 
Note: a chartered secretary refers to a person who is a current full member of the Chartered Governance 
Institute or its designated divisions. 
Paragraph Certification In general, only the identification document used for the purpose of identity verification (eg official document 
4.10.3 of the Neer RAN Sn eey such as an identity card, passport, certificate of incorporation, or certificate of incumbency issued by registered 
AML/CFT See tO USE agent etc) should be subject to certification. 
Cucina certification as a 





supplementary measure to 
fulfil the requirement of 
section 9 of Schedule 2, 
what types of documents 
should be certified? 





Certification can be time consuming and costly, so there is no need or expectation to require certification for all 
other CDD information or documents provided by the customer; or to require certification if an Al is able to 
check the documents against public sources. 


As a general principle, customers should always be provided with the opportunity, if they wish to do so, to 
present their original documents to the staff of the Al. 
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: Paragraph 
4.8 of the 
AML/CFT 
Guideline 


Specific customers in non- 
equivalent jurisdiction 


SDD in relation to beneficial 
owners is permitted in 
relation to public bodies, Als 
and investment vehicles in 
Hong Kong or “equivalent” 
jurisdictions. Is an Al entitled 
to conduct SDD on such 
entities in non-equivalent 
jurisdictions? 


If the customer is in a non-equivalent jurisdiction this should be taken into account in determining the risk level 
of the customer, and the extent of customer due diligence measures to be applied should be commensurate 
with the assessed level of risk. If the level of ML/TF risk is assessed as low, SDD under paragraphs 4.8.1 to 
4.8.8 (except paragraph 4.8.8(b)) can be applied (ie reducing the extent of CDD measures taken). However, 
appropriate identification and verification measures in relation to the beneficial owners must still be undertaken, 
as this scenario does not involve a customer of the type specified in section 4 of Schedule 2 to the AMLO. It is 
simply that the extent of measures undertaken might be less, on an RBA. 





Ag Paragraph 
4.8.12 of the 
AML/CFT 
Guideline 








Listed company beneficial 
owner transparency 


How does an Al establish if a 
listed company is subject to 
disclosure requirements that 
ensure adequate 
transparency of beneficial 
ownership? 





In determining whether a listed company is subject to disclosure requirements that ensure adequate 
transparency of the company’s beneficial ownership, an Al could take into account the following factors, for 
example: 


(a) whether there is a statutory regime that requires the disclosure of interests in listed companies above a 
certain threshold, either by the shareholder concerned or by the listed company in question; 


(b) the existence of penalties for non-compliance (pecuniary or otherwise) with the disclosure requirements; 
(c) aclear minimum shareholding threshold that triggers disclosure — in general, it should be at least the 
beneficial ownership threshold under the AMLO (more than 25%), or lower if needed to reflect the Al’s 


internal standards; 


(d) a specified timeframe for disclosure — in general, it would normally be expected that disclosures should be 
made within a limited number of days of the relevant triggering event; and 


(e) public access to the shareholder information. 
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Paragraph 


Customer risk factor 


No, this should be determined on a case-by-case basis. 











w Where a customer, or in the Where a customer’s main business and areas of focus are in another jurisdiction, if the Al is satisfied with the 
Guideline case of a legal person reason for opening / maintaining an account in Hong Kong, the difference in location does not necessarily have 
customer, its connected to be considered a high ML/TF risk indicator. 
parties, PPTAs or beneficial 
owners, are located 
overseas, must the customer 
be considered high risk? 
Paragraph Source of wealth No. The requirement to collect source of wealth information ordinarily applies to higher risk situations and 
4.6.1, 4.9.6, , therefore Als are not expected to establish source of wealth for each and every customer. 
4910 and Do Als need to establish Kees a 
12.3 of the source of wealth for every For most customers that are non-high risk customers, certain information obtained by an Al to understand the 
AML/CFT customer? purpose and intended nature of the business relationship (eg occupation of individual customers, or business 
Guede nature of corporate customers) should be sufficient for the Al to have a basic understanding of the customer's 
profile and accordingly be able to monitor that the account balance, and value and volume of transactions, is in 
line with their expected wealth and customer's profile. 
Even when establishment of source of wealth is required, there is no expectation to apply the same source of 
wealth procedures to all relevant customers in the same manner, or collect evidence dating back decades 
when the risk does not justify doing so, as it is often impractical. 
Paragraph Source of wealth When an Al is required to establish the source of wealth of an individual, it should adopt an RBA to determine 
4.9.2, 4.9.6, a AE Aa the extent of measures (ie the extent of measures should be commensurate with the level of ML/TF risk of the 
4.9.10, 4.9.15 p $ customer concerned). It is not necessary for the Al to obtain evidence to corroborate the information provided 
and 4.9.22, of based approach ie lationile to the Al or to verify the individual’s net worth in all cases. Where appropriate, the Al may seek evidence from 
the AML/CFT establishing e UIce oi a reliable, independent source that can corroborate the gist of the source of wealth information (eg publicly 
Guideline ween Ci em imece available property registers, land registers, asset disclosure registers or company registers). 








Further guidance in relation to understanding the source of wealth of a customer that presents a higher risk of 
ML/TF is set out at Appendix 1 to these FAQs. 
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Paragraph Jurisdictions subject to a Only jurisdictions listed in the FATF statement: “High-Risk Jurisdictions subject to a Call for Action” should be 
4.15 of the call by the FATF regarded as “jurisdictions for which this is called for by the FATF” under paragraph 4.15.1 of the AML/CFT 
AML/CFT Which jurisdicti Guideline. EDD measures that are proportionate to the risks should be conducted on business relationships 
Guideline CaJursocuonsarg and transactions with customers from these jurisdictions. 
subject to a call by the 
FATF? For the avoidance of doubt, conducting EDD measure is not mandatory for customers connected to 
jurisdictions listed in the FATF statement: “Jurisdictions under Increased Monitoring”. However, the fact that a 
customer is connected to such a jurisdiction should be taken into account in determining the overall risk profile 
of the customer. 
Paragraph International organisation Yes, agencies of the UN are international organisations and such agencies are listed on the UN website 
4.9.12 of the PEPs currently available at the following website: https:/www.un.org/en/sections/about-un/funds-programmes- 
AML/CFT ; specialized-agencies-and-others/index.html 
euidcune Are agencies of the UN 
considered to be 
“international organisations” 
for the purposes of 
establishing PEP status? 
Paragraph International organisations | “/nternational organisations” are defined in the AML/CFT Guideline as entities established by formal political 
4.9.13 of the PEPs agreements between their member States that have the status of international treaties; their existence is 
AML/CFT erouidanaividualewihta recognised by law in their member countries; and they are not treated as resident institutional units of the 
Guideline countries in which they are located. As such, individuals at organisations that do not meet these criteria are not 





prominent function at all 
kinds of international 
organisations be regarded as 
a PEP?” 





international organisation PEPs. 


However, if an individual holds a prominent function at an organisation that may have certain similarities to, but 
which nevertheless does not meet the prescribed definition of, an “international organisation” (eg an 
international sport association), the Al should consider whether this impacts the risk profile of the customer. 
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Paragraph 


Former foreign PEPs 


An Al should apply all the EDD measures set out in paragraph 4.9.10 of the AML/CFT Guideline even when a 











4.9.7 and Should an Al ly EDD foreign PEP is no longer entrusted with a prominent public function. The Al should nevertheless adopt an RBA 
4.9.21 of the Ou an A eek in determining the extent of EDD measures taking into account factors like the level of influence that a foreign 
AML/CFT IESE Oil foreign PEPE PEP may continue to exercise after stepping down from the prominent public function. 
encaine that are no longer entrusted 

with a prominent public 

function? 
Paragraph Former domestic or If a domestic PEP or an international organisation PEP is no longer entrusted with a prominent (public) 
4.9.16 and international organisation function, an Al may adopt an RBA to determine whether to apply or continue to apply the EDD measures set 
4.9.21 of the PEPs out in paragraph 4.9.10 in a high risk business relationship with a customer who, or whose beneficial owner is, 
AML/CFT that domestic PEP or international organisation PEP, taking into account various risk factors. 
Guideline Should an Al apply EDD 

measures on domestic or For the avoidance of doubt, the extent of any EDD measures applied should also be determined on an RBA 

international organisation according to paragraph 4.9.21 of the AML/CFT Guideline. 

PEPs that are no longer 

entrusted with a prominent 

public function? 
Paragraph Senior management It is for individual Als to determine this question, as organisational structures vary from Al to Al. Als should 
4.9.10 and approval maintain clear and documented policies setting out the persons within the institution who are able to approve 
4.9.21 of the Wh lifi ees PEP customer onboarding and a continued business relationship. In any event, it should only include those 
AML/CFT oques aS Senor with sufficient seniority. The number and title of such persons will vary according to the size, type and 
Guideline menegemenit tor die institutional risk assessment of the Al. Senior management may include personnel in another jurisdiction if this 





purposes of being able to 
approve establishing / 
continuing a business 
relationship with a PEP? 





reflects the Al’s organisational structure and risk management practices. 
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Relevant 
provisions 


Intermediaries 













Footnote 35 
of the 
AML/CFT 
Guideline 


Paragraph 
11.1 of the 
AML/CFT 
Guideline 





Correspondent banking 








Question 


Using intermediaries for 
ongoing monitoring 


Can an intermediary be 
relied upon to conduct 
ongoing monitoring as per 
section 5 of Schedule 2 to 
the AMLO? 


“Another institution” 


In the definition of 
correspondent banking, what 
is meant by the term 
“another institution”? 








No. Section 18 of Schedule 2 only allows an Al to carry out any CDD measures set out in section 2 of 
Schedule 2 by means of an intermediary but does not allow an Al to rely on an intermediary to continuously 
monitor relevant business relationships as required by section 5 of Schedule 2. Therefore, an Al cannot rely on 
an intermediary to continuously monitor its business relationships with a customer (ie ongoing CDD and 
transaction monitoring). 


However, the Al may use an intermediary to collect further documents, data and information, and provide or 
coordinate relevant updates, to assist the Al in ensuring that the CDD records maintained by the Al remain up- 
to-date and relevant. 







While the AMLO does not define what “another institution” means in the definition of correspondent banking, 
section 7 and section 14 of Schedule 2 only apply to correspondent banking relationship with an institution 
located in a place outside of Hong Kong that carries on a business similar to that carried on by an Al. 
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Paragraph 
11.2 of the 
AML/CFT 
Guideline 





Non-customer 
relationships 


A correspondent banking 
relationship does not include 
occasional transactions or 
the mere exchange of 
SWIFT RMA keys in the 
context of “non-customer 
relationships’. What is 
considered a non-customer 
relationship for the purposes 
of this requirement? 





“Non-customer relationship” refers to a relationship that does not fall under the definition of business 
relationship in the AMLO and the counterparty is not regarded as a “customer” of the Al (also see paragraph 
4.1.5 of the AML/CFT Guideline). 


A non-customer RMA relationship is generally created when there is a request that the bank sends or receives 
SWIFT messages to/from a third party (ie the non-customer) in support of a customer’s business and where the 
bank has no other relationship with that third party. This can include both transactional and non-transactional 
messages. Such arrangements are sometimes referred to as “network banks,” which facilitate the continuing 
ability to meet customer global trading expectations and requirements. 


Network banks are non-customer banks and have no accounts, facilities or dedicated relationship manager. 
They are sponsored by a global line of business and interactions are limited to document exchanges and 
restricted SWIFT RMA message interactions. The settlement of any transaction is decoupled from the 
document exchange and always made via a customer bank. 


Some examples of where non-customer RMAs may be established to facilitate activities for existing customers 
include, but are not be limited to, the following: 


(a) Cash management: receipt of balance and transaction information on a corporate customer's account at 
another bank, so that the corporate customer can view activity through its bank’s reporting tool 


(b) Cash management: relaying payment instructions from a corporate customer to their third party bank 


(c) Custody: provision of information from a sub custodian bank to the global custodian at the request of the 
client 


(d) Trade Finance (eg letters of credit): exchange of messages with banks that do not otherwise have direct 
payment relationships 


(e) Exchange of messages with payments and securities markets infrastructure entities, eg exchanges and 
depositories 


(f) Message relaying intermediary bank: serving as an intermediary bank only to relay transactional or non- 
transactional measures without any accounts opened 


(g) Principal to principal and treasury transactions: the relationship facilitates principal to principal transactions 
or treasury deals only, such as foreign exchange trading or bond trading 
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6 Paragraph 
11.6 of the 
AML/CFT 
Guideline 


Responsibilities of each 
party 


Als are required to 
understand and document 
clearly the agreed lines of 
responsibility for AML/CFT in 
a correspondent banking 
relationship. Must this be in 
written form? 


It is not mandatory for the two Als to reduce their respective responsibilities to a written contract provided there 
is a clear understanding as to which institution will perform the required measures in relation to AML/CFT and 
this is documented (eg through an exchange of correspondence or where responsibilities are bound by SWIFT 
terms and conditions). 





6 Paragraph 
11.8 of the 
AML/CFT 
Guideline 


Additional measures 


Is an Al required to obtain 
and record all the 
jurisdictions in which a 
respondent bank has its 
subsidiaries and branches? 


No. The information that has been taken into account in determining the extent of additional measures to be 
applied should be recorded. Factors that increase risk and mitigating factors should all be recorded if they 
have informed the decision-making process regarding the additional steps to be taken, this will not always 
involve recording all jurisdictions in which the respondent bank is present. 








64 Paragraph 
12.6 of the 
AML/CFT 
Guideline 


Adverse news screening 


In addition to the private 
banking customer, on whom 
should an Al perform 
adverse news screening? 


An Al should conduct adverse news screening on a private banking customer, and any other persons known by 
the Al to be associated with that customer as far as practicable, before establishing the private banking 
relationship. For the purposes of this requirement, “any other persons known by the Al to be associated with 
the customer’ may include known living family members and known living business associates who are known 
to have contributed to the source of wealth of the customer. 





6 Paragraph 
12.10 of the 
AML/CFT 
Guideline 








Meetings 


How often is an Al required 
to meet their private banking 
customers? 





An Al is required to meet their private banking customers on a regular basis as far as possible. The frequency 
of meetings should be commensurate with the customer’s assessed ML/TF risk profile. 
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Paragraph Using technology to An Al can use technology to facilitate a meeting with a private banking customer, eg real-time video 
12.8 of the facilitate meetings conferencing call, provided that the audio-visual quality enables effective communication. 
AML/CFT 
as What technology can an Al 

Guideline z 

use in order to conduct a 

meeting with a customer? 
Paragraph Trigger events Trigger events include: 
e What could constitute a (a) when a significant‘ transaction is to take place; 

oer “trigger event’ for the ‘ i ; 

Guideline purposes of requiring a CDD (b) when a material change occurs in the way the customer's account is operated; 

review? (c) when the Al’s customer documentation standards change substantially; or 

(d) when the Al is aware that it lacks sufficient information about the customer concerned. 

Paragraphs Re-activation of adormant | Als should adopt appropriate risk management policies and procedures to manage the risks associated with 
4.12.2, 5.2 account the reactivation of dormant relationships. These policies and procedures should include, for example, 
and footnote Wh a eet P establishing a reasonable timeframe for the completion of CDD review on an RBA, and if account use is 
42 of the ae Pas ia IS permitted before completion imposing risk mitigating controls such as restricting account functions, imposing 
AML/CFT re So eos Aue transaction limits or implementing enhanced transaction monitoring measures before completing the CDD 
Guideline (equiveel toy g ie a review. 

trigger event CDD review 

before re-activating the 

relationship? 

















The word “significant” is not necessarily linked to monetary value. It may include transactions that are unusual or not in line with the Al’s knowledge of the customer. 
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69 Chapter 7 of 
the AML/CFT 
Guideline 


Reporting requirement 
under National Security 
Law (NSL) 


Who should NSL-related 
STRs be filed to? 


All STRs should continue to be filed to the Joint Financial Intelligence Unit (JFIU) following existing reporting 
mechanism, i.e. STREAMS, and the “consent / no consent” systems will remain. Als can click the box 
“National Security Law” under the “Reason for Disclosure” column in the STR Proforma, where appropriate. 
Note: While it is recognised that Als may not be able to have full knowledge of the exact nature of the 
underlying crime, it is expected that these categories are selected on a best effort basis. 





1} Chapter 7 of 


Reporting requirement 


The obligation for reporting under the NSL will be triggered when an Al “knows” or “suspects” that any property 











“offence related property” in 
NSL and under what 
circumstances should an Al 
disclose this property to the 
JFIU? 





the AML/CFT | under NSL is offence related property. The threshold for reporting is the same as under existing arrangements under the 
Guideline What Als’ rti Organized and Serious Crimes Ordinance (OSCO), the Drug Trafficking (Recovery of Proceeds) Ordinance 
a E A S ig aie (DTROP) and the United Nations (Anti-Terrorism Measures) Ordinance (UNATMO). The time frame for 

Fea ue VEN meer the reporting is also the same, ie Als should file an STR to the JFIU as soon as reasonably practicable. 

NSL? Is the reporting 

threshold the same as 

OSCO? 
Chapter 7 of Offence related property “Offence related property” as defined under section 1 of Schedule 3 to the Implementation Rules of the NSL 
the AML/CFT What is the definition of refers to the property of a person who commits or attempts to commit, or participates in or facilitates the 
Guideline commission of, an offence endangering national security; or property used / intended to be used for financing 


or assisting the commission of an offence endangering national security. “Offence endangering national 
security” refers to offence of that nature under the NSL and the laws of the HKSAR safeguarding national 
security. 


Pursuant to section 5 of Schedule 3 to the Implementation Rules of the NSL, the following non-exhaustive 
scenarios can be regarded as circumstances that trigger a disclosure obligation: 


a) When it comes to Als’ attention that a person is arrested / charged for an offence endangering national 
security; and / or 


b) When Als have knowledge or suspicion that a property is “offence related property” after receiving 
information from law enforcement agencies. 


The Als MUST make a disclosure of the property held by the persons specified in (a) or the circumstance in 
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relation to (b) to JFIU. For the avoidance of doubt, such property includes all kind of property regardless of the 
portion of shareholdings by the persons specified in (a). 


If you wish to contact the National Security Department of the Hong Kong Police Force (NSD) for advice, you 
can do so by the following means: 


NSD Hotline for Financial Institutions: 2896 3270 
Email: enquiry3@police.gov.hk 














Paragraph Law enforcement requests | No. As with the existing practice under OSCO, DTROP and UNATMO, requests by the law enforcement 
7.31 the Would Als b cd agencies for information of an account managed in other jurisdictions will be made through Mutual Legal 
AML/CFT ou SIVE TEgUESIE Assistance (involving the Department of Justice). Such requests will not be made through the Als. 
Guideline under search warrants i 
related to NSL to submit 
information of customer's 
accounts in their branches or 
subsidiaries in other 
jurisdictions? 
Paragraph Law enforcement requests | A search warrant will ordinarily be obtained by law enforcement agencies when searching an Al’s records. 
7.31 the EETA InGer Under exceptional circumstances where it would not be reasonably practicable to obtain such a search warrant, 
AML/CFT ; tes a police officer at or above the rank of Assistant Commissioner of Police may authorise the search. In such 
Guideline exceptional a a | cases a formal written document will be produced to the Al on spot, with the name and contact details of the 
P e fe or authorized officer clearly stated. Similar arrangements also exist under various other existing ordinances, such 
Cera ao ae! as the Gambling Ordinance. 
evidence under NSL. How 
are Als able to ascertain if 
authority has been conferred 
for such actions? 
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í Paragraph “Relevant party” An Al should, at a minimum, screen the following relevant parties in a cross-border wire transfer: 
6.16(c) of the : DE : 
In a cross-border wire (a) originator; 
AML/CFT 
Guideline iranan who must be (b) recipient; 
screened as a “relevant : 
party”? (c) ordering institution; 
(d) intermediary institution; 
(e) beneficiary institution; and 
(f) named parties (eg individuals, companies, banks etc) in the payment message. 
Paragraph Accuracy of originator The required originator information is deemed to be accurate if the identity of the originator has been verified in 
10.8 of the information compliance with the AMLO and the AML/CFT Guideline. No further verification of the originator information is 
AML/CFT ‘ normally required, although ordering institutions may exercise their discretion to do so in individual cases. 
Guideline How should an ordering 


institution ensure that the 
required originator 
information is accurate? 





6 Paragraph 
10.8 of the 
AML/CFT 
Guideline 








Originator’s address 


For wire transfers over 
$8,000,can the originator's 
address accompanying the 
wire transfer be a PO box 
address? 





The address information accompanying the wire transfer should be sufficient to identify clearly the location of 
party / parties for sanctions screening and AML/CFT monitoring purposes. Therefore, having a Post Office 
(PO) Box as an address should be avoided except where no alternative exists. 
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Relevant Question 
provisions 


Record-keeping 















Chapter 8 of Record-keeping of 
the AML/CFT | unsuccessful applicants 


Guideline 
For cases of unsuccessful 


application for business, is 
an Al required to retain the 
identification records and 
documents in relation to the 
unsuccessful applicants? 


Issues relating to financial group 





Paragraph 


4.1.6 of the } 
AML/CFT What is meant by the term 


“managed in substance” 
within the meaning of 
paragraph? 


Managed in substance 


Guideline 








Under the AMLO, there is no requirement for an Al to maintain records and documents involving unsuccessful 
applicants. This, however, does not preclude the Al from retaining the relevant records and documents in order 
to meet its other statutory obligations. 





The term “managed in substance” refers to the substantive aspects of the business relationship, rather than the 
performance of mere administrative or back-office functions. Such a determination has to take into account the 
particular circumstances of an Al. 


In general, if an Al carries out relationship management for a customer whose account is booked outside Hong 
Kong, the Al will have a business relationship with the customer (see definition of business relationship in Part 
1 of Schedule 2 to the AMLO). 


For the avoidance of doubt, relationship management may take place from more than one location. 
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9 Paragraph 
3.15 of the 
AML/CFT 
Guideline 


Overseas subsidiaries 


With reference to section 
22(1)(b) of Schedule 2, 
where a bank incorporated in 
Hong Kong has a subsidiary 
that carries on a securities or 
insurance business outside 
Hong Kong, will section 22 
apply to such a subsidiary ie 
is the subsidiary regarded as 
“carrying on the same 
business as a financial 
institution in a place outside 
Hong Kong”? 


It should be noted that section 22(1)(b) of Schedule 2 states “the same business as an FI” but not “the same 
business as the FI”. The term “FI” refers to an FI as defined in the AMLO, including authorized institution, 
licensed corporation, authorized insurer, etc. Therefore, so long as the overseas subsidiary carries out the 
business as any type of FI (not necessarily as the same type of the business of the parent company), then this 
provision will apply. 





80 Paragraph 
3.17 the 
AML/CFT 
Guideline 








Group-wide information 
sharing 


Article 63 of the NSL 
stipulates that the relevant 
institutions, organisations 
and individuals who assist 
with the handling of a case 
shall keep confidential any 
information pertaining to the 
case. Would the sharing of 
information with overseas 
head offices/branches 
/subsidiaries for risk 
management purposes 
breach this requirement? 





As with existing obligations under the OSCO, DTROP and UNATMO, Als should also observe information 
confidentiality requirements under the NSL and must not disclose to another person any information or other 
matter which is likely to prejudice any investigation which might be conducted. The sharing of information with 
overseas head offices/branches/subsidiaries for risk management purposes, as global financial institution 
lawfully do now, will not be affected. 
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Appendix 1 — Establishing source of wealth? 


Good practice 


The below sets out a sample of good practices to be taken in relation to establishing the source of wealth of 
an individual. 


e (When the type or level of business activity diverges from the 
customer’s source of wealth) Promptly conducting further 
assessments on the customer’s source of wealth and reconsidering how 
to manage the business relationship with the customer (for example, 
establishing, maintaining or terminating business relationship) 


° (Where there is an absence of information to ascertain the source 
of wealth) Considering information on publicly disclosed assets — for 
example, asset disclosure systems which allow public access to 
information in the disclosure made by certain PEPs® 


e (When obtaining information from a self-declaration) Verifying the 
accuracy of the customer’s declaration about the source of wealth 
through reliable sources such as: 


o publicly available property registers; 
o land registers, asset disclosure registers, company registers; 
o past transactions with Als (for existing customers); and 


o other sources of information about legal and beneficial ownership. 


e Challenging the source of wealth information (where appropriate) during 
the customer due diligence process 

° Conducting validation and corroboration (where appropriate) 

e Establishing effective escalation and advisory procedures to ensure that 


high risk customers, including PEPs, are appropriately identified and 
handled, and that staff responsibilities are clear 


° Establishing other clear risk-based policies and procedures, such as 
setting out the EDD measures required for higher-risk and PEP 
customers and on source of wealth 


e Proactively following up gaps in, and updating, source of wealth 
information for higher-risk relationships during the course of the 
relationship 

e Reviewing relationships periodically to ensure due diligence information 


remains current, and the risk assessment and associated controls 
remain appropriate 





Attention is also drawn to the “Wolfsberg Source of Wealth and Source of Funds (Private Banking/Wealth Management) 
FAQs” published on 7 August 2020, available here: https://wolfsberg-principles.com/articles/publication-source-wealth-and- 
source-funds-private-bankingwealth-management-fags 

Note that not all jurisdictions have such an asset disclosure system. It is often the case that there is only summary of 
information filed by these PEPs is made publicly available. 
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Poor practices 


The below are examples of measures that would not generally be acceptable: 


(a) 


failing to properly apply risk-based approach - source of wealth requirements 
(particularly when conducting verification) are not sufficiently risk-based, such as applying 
the same measures to customers of varying risks or collecting too little or too much 
information; 


taking information provided by clients at face value - always accepting a customer's 
explanation and material provided for source of wealth at face value, without probing 
further even where red flags are raised or raising insufficient challenge to source of wealth 
information; 


over-reliance - on undocumented information, particularly, relying on a self-declaration by 
the customer as to its source of wealth without verifying the information in the customer 
declaration through reliable external or internal sources; 


relying on intra-group introductions - where overseas standards are not equivalent to 
Hong Kong or where due diligence data is inaccessible because of legal constraints; 


granting waivers from establishing source of wealth where it is mandatory; and 


failing to distinguish - between a customer’s source of wealth and source of funds. 


Source of wealth examples 


Source of wealth 


information should give an indication as to the size of wealth the customer would be 


expected to have, and a picture of how the individual acquired the wealth. It may be possible to gather this 


information from: 


official documents issued by a government or public body; 
public information and open sources, such as reputable sources on the Internet; 


confirmation from a professional service provider with knowledge of the customer (such as 
an accountant, lawyer, professional trustee or company services provider); or 


copies of primary sources, for example: 


- Recent payslips 


Income savings - Income tax returns 


Property sale 


Inheritance 


- Banks statements showing three months salary 


- Land registry evidence 
- Signed letter from a solicitor or estate agent 
- Completed sale contract 


- Land registry evidence 
- Signed letter from a solicitor or estate agent 
- Completed sale contract 
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a - Loan agreement 
- Recent loan statements 
- Letter from professional/accountancy body 
providing details of the company's profile over the 
Dividends last [12] months 
- Copy of company accounts 
miste i - Trust deeds describing the assets and names of 
; the settlor 


- Bank statement showing a deposit fromthe 
; i e laale] lare Me) ge CIEL elg] 
Samaan - Letter fromthe gamling organisation 
ACERTE eE 


- Court order 
Compensation ; - Letter from compensating body (if no court order 
l EWZ-lit=19)(-9) 
- Signed letter from a solicitor 
a ET - Sale contract 
eat! - Media coverage 


- Court order 
- Signed letter from a solicitor 


Divorce settlement 


- Certificates 
- Contract notes 


- Bank statements showing receipt of funds and 
investment entity names 


Sale of investments 
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